The proliferation of personal computers at the household level has led to an unprecedented use of the Internet for buying items, conducting other business transactions, and obtaining information. In many instances, confidential information such as credit card numbers and social security numbers are exchanged online. Accordingly, in order to protect the exchange of such confidential information, the Secure Sockets Layer Protocol (SSL) was developed. The SSL is an application layer protocol designed to protect communications layered over the transport control protocol/Internet protocol (TCP/IP). The use of SSL is commonplace within most corporate environments and nearly all online merchants provide SSL communication to protect the security of confidential information received from consumers.
While the use of SSL has the benefit of providing for the secure transmission of data, it is counterproductive with respect to a corporation's need to affectively protect its internal network against software viruses and to closely monitor the content of data electronically transmitted into and out of the corporate network. That is, most corporations have at least one corporate monitoring server (TCM Server) through which all incoming and outgoing corporate electronic communications pass. The TCM server typically has anti-virus applications that are used to detect and prevent viruses from being disseminated through the corporate network. Additionally, the TCM server may include a firewall which will prevent the transmission of data into or out of the corporate network based on destination or source IP addresses, the port to which the transmission is directed, or the content of the data being transmitted. Therefore, in those instances where the anti-virus applications and the firewall technology require access to the application layer data in order to be effective, the use of the SSL prevents the TCM server from being able to read and filter the application layer data.
The above situation is particularly important in a corporate (or government environment) where proprietary and confidential information is closely guarded. If SSL communications are permitted, the free electronic dissemination of such proprietary and confidential information via the Internet is possible without the approval or knowledge of the corporate or government entity. The unauthorized dissemination of such important information can expose the company to severe economic disadvantages and legal liability in those instances where the company has a legal obligation to control the dissemination of such information.
Presently, a company could prevent all SSL communications from passing through the TCM server in order to overcome the problems discussed above. However, this approach eliminates the use of SSL entirely including those SSL communications that are legitimate and needed for business purposes.
Accordingly, what is needed is a method and apparatus that permits an SSL communication through a TCM server while providing the TCM server with the ability to read and filter such SSL transmissions.